CLAIMS 



1 . A method of providing security, comprising: 

accessing a database configured to store operational information 
associated with a process; 
5 determining a first behavior using the operational information, wherein the 

first behavior is associated with the process; 
monitoring the process; and 

comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process. 
10 2. A method of providing security as recited in Claim 1, in the event the second 
behavior is determined to be different from the first behavior, the second behavior is 
determined to be disallowed. 

3. A method of providing security as recited in Claim 1, wherein the first behavior is 
one of a plurality of behaviors determined using the operational information. 
15 4. A method of providing security as recited in Claim 1 , wherein the first behavior is 
one of a plurality of behaviors determined using the operational information, and in the 
event the second behavior is determined to be different from the plurality of behaviors, 
the second behavior is determined to be disallowed. 

5. A method of providing security as recited in Claim 1 , further comprising 
20 determining that the second behavior is disallowed. 
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6. A method of providing security as recited in Claim 1 , further comprising 
determining that the second behavior is disallowed and performing a predetermined 
action. 

7. A method of providing security as recited in Claim 1, further comprising 

5 determining that the second behavior is disallowed and performing a predetermined 
action, wherein the predetermined action includes preventing the second behavior from 
succeeding. 

8. A method of providing security as recited in Claim 1, further comprising 
determining that the second behavior is disallowed and performing a predetermined 

10 action, wherein the predetermined action includes generating an event associated with the 
second behavior. 

9. A method of providing security as recited in Claim 1, wherein determining the 
first behavior using the operational information is performed when the process is not 
operating. 

15 10. A method of providing security as recited in Claim 1 , wherein the operational 
information includes optimization information. 

11. A method of providing security as recited in Claim 1 , wherein the operational 
information includes optimization information, and the optimization information is used 
to improve process initialization time. 
20 12. A method of providing security as recited in Claim 1 , wherein the operational 

information includes optimization information, and wherein the optimization information 
is configured on a per user basis. 



Attorney Docket No. SYMAP044 



PATENT 



13. A method of providing security as recited in Claim 1, wherein the operational 
information includes component access information. 

14. A method of providing security as recited in Claim 1, wherein the database 
includes a prefetch file. 

15. A method of providing security as recited in Claim 1 , wherem the database 
includes a superfetch file. 

16. A system for providing security, comprising: 

a processor configured to: 

access a database configured to store operational information 
associated with a process; 

determine a first behavior using the operational information, 
wherein the first behavior is associated with the process; 

monitor the process; and 

compare a second behavior with the first behavior, wherein the 
second behavior is attempted by the process; and 

a memory coupled with the processor, configured to provide the processor 
with directions. 

1 7. A computer program product for providing security, the computer program 
product being embodied in a computer readable medium and comprising computer 
instructions for: 

accessing a database configured to store operational information 
associated with a process; 
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determining a first behavior using the operational information, wherein the 
first behavior is associated with the process; 
monitoring the process; and 

comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process. 

18. A method of providing security, comprising: 

determining a first behavior, wherein the first behavior is associated with a 
prefetch file; 

monitoring a process, wherein the process is associated with the first 
behavior; and 

comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process. 

19. A system for providing security, comprising: 



a processor configured to: 

determine a first behavior, wherein the first behavior is associated 
with a prefetch file; 

monitor a process, wherein the process is associated with the first 
behavior; and 

compare a second behavior with the first behavior, wherein the 
second behavior is attempted by the process; and 



a memory coupled to the processor, confi^jifed to provide the processor 
with instructions. 
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20. A computer program product for providing security, the computer program 
product being embodied in a computer readable medium and comprising computer 
instructions for: 

determining a first behavior, wherein the first behavior is associated with a 
prefetch file; 

monitoring a process, wherein the process is associated with the first 
behavior; and 

comparing a second behavior with the first behavior, wherein the second 
behavior is attempted by the process. 
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